Unlimited Elements for Elementor vulnerabilities

Known security issues in the Unlimited Elements for Elementor WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: unlimited-elements-for-elementor
Latest version: 2.0.24
Active installs: 300,000+
Known vulnerabilities: 63
Data updated: 2026-10-17 10:22 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 2.0.23 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.23
Vulnerability	Severity	CVSS	Affected versions	Published
[en] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Parameter CVE-2026-105064 · Source	Medium	6.5	< 2.0.23	2026-10-05

Fixed in version 2.0.21 (10)

Unlimited Elements for Elementor: Fixed in version 2.0.21
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements for Elementor <= 2.0.20 - Unauthenticated SQL Injection CVE-2026-103355 · Source	Critical	9.3	< 2.0.21	2026-10-04
Unlimited Elements for Elementor <= 2.0.20 - Authenticated (Contributor+) SQL Injection CVE-2026-103338 · Source	High	8.5	< 2.0.21	2026-10-01
Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting CVE-2026-103344 · Source	High	7.1	< 2.0.21	2026-10-04
Unlimited Elements for Elementor <= 2.0.20 - Reflected Cross-Site Scripting CVE-2026-103342 · Source	High	7.1	< 2.0.21	2026-10-03
Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2026-92924 · Source	Medium	5.4	>= 2.0.18 and < 2.0.21	2026-10-02
Unlimited Elements for Elementor <= 2.0.20 - Missing Authorization CVE-2026-103341 · Source	Medium	5.3	< 2.0.21	2026-10-01
[en] The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators CVE-2026-85015 · Source	Not rated	-	< 2.0.21	2026-10-03
Unlimited Elements For Elementor <= 2.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-85016 · Source	Not rated	-	< 2.0.21	2026-10-02
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Authenticated (Subscriber+) SQL Injection CVE-2026-92923 · Source	Not rated	-	>= 2.0.18 and < 2.0.21	2026-10-02
Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQL Injection CVE-2026-85568 · Source	Not rated	-	>= 1.5.139 and < 2.0.21	2026-10-02

Fixed in version 2.0.20 (4)

Unlimited Elements for Elementor: Fixed in version 2.0.20
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements for Elementor <= 2.0.19 - Authenticated (Contributor+) PHP Object Injection CVE-2026-95534 · Source	High	8.8	< 2.0.20	2026-10-05
Unlimited Elements for Elementor <= 2.0.19 - Unauthenticated Stored Cross-Site Scripting CVE-2026-94662 · Source	High	7.1	< 2.0.20	2026-10-05
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Contributor+) Server-Side Request Forgery CVE-2026-66608 · Source	Medium	6.4	< 2.0.20	2026-09-17
Unlimited Elements For Elementor <= 2.0.19 - Authenticated (Subscriber+) PHP Object Injection CVE-2026-85017 · Source	Not rated	-	< 2.0.20	2026-09-17

Fixed in version 2.0.18 (3)

Unlimited Elements for Elementor: Fixed in version 2.0.18
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 2.0.17 - Unauthenticated Stored Cross-Site Scripting CVE-2026-84820 · Source	High	7.1	< 2.0.18	2026-09-08
Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter CVE-2026-75586 · Source	Medium	6.1	< 2.0.18	2026-08-03
Unlimited Elements For Elementor <= 2.0.17 - Missing Authorization CVE-2026-85304 · Source	Medium	5.3	< 2.0.18	2026-09-03

Fixed in version 2.0.17 (2)

Unlimited Elements for Elementor: Fixed in version 2.0.17
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection CVE-2026-18561 · Source	High	7.5	< 2.0.17	2026-09-10
Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting CVE-2026-77150 · Source	Medium	6.1	< 2.0.17	2026-09-10

Fixed in version 2.0.16 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.16
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 2.0.15 - Missing Authorization CVE-2026-28147 · Source	Medium	5.4	< 2.0.16	2026-08-03

Fixed in version 2.0.15 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.15
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 2.0.14 - Authenticated (Contributor+) Arbitrary File Download CVE-2026-28146 · Source	Medium	6.5	< 2.0.15	2026-08-03

Fixed in version 2.0.13 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.13
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 2.0.12 - Unauthenticated Stored Cross-Site Scripting CVE-2026-57718 · Source	High	7.1	< 2.0.13	2026-07-09

Fixed in version 2.0.11 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.11
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements for Elementor <= 2.0.10 - Unauthenticated Stored Cross-Site Scripting CVE-2026-10081 · Source	Not rated	-	< 2.0.11	2026-06-29

Fixed in version 2.0.9 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.9
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 2.0.8 - Authenticated (Contributor+) SQL Injection CVE-2026-48837 · Source	High	8.5	< 2.0.9	2026-05-25

Fixed in version 2.0.8 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.8
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter CVE-2026-5486 · Source	Medium	6.5	< 2.0.8	2026-05-13

Fixed in version 2.0.7 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.7
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal in Repeater JSON/CSV URL with Path Traversal CVE-2026-4659 · Source	High	7.5	< 2.0.7	2026-04-16

Fixed in version 2.0.6 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.6
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via Form Entry Fields CVE-2026-2724 · Source	Not rated	-	< 2.0.6	0000-00-00

Fixed in version 2.0.2 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.2
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget CVE-2025-14274 · Source	Medium	5.4	< 2.0.2	2026-02-02

Fixed in version 2.0.1 (1)

Unlimited Elements for Elementor: Fixed in version 2.0.1
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) <= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload CVE-2025-13692 · Source	High	7.2	< 2.0.1	2025-11-26

Fixed in version 1.5.149 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.149
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-8603 · Source	Medium	6.4	< 1.5.149	0000-00-00

Fixed in version 1.5.143 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.143
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-1663 · Source	Medium	5.4	< 1.5.143	0000-00-00

Fixed in version 1.5.141 (2)

Unlimited Elements for Elementor: Fixed in version 1.5.141
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget CVE-2024-13155 · Source	Medium	6.4	< 1.5.141	2025-02-19
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 · Source	Medium	6.1	< 1.5.141	2026-04-30

Fixed in version 1.5.136 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.136
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.135 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets CVE-2024-13153 · Source	Medium	6.4	< 1.5.136	2025-01-08

Fixed in version 1.5.127 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.127
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-10784 · Source	Medium	6.4	< 1.5.127	2024-12-11

Fixed in version 1.5.122 (2)

Unlimited Elements for Elementor: Fixed in version 1.5.122
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.121 is vulnerable to Remote Code Execution (RCE) CVE-2024-49271 · Source	Critical	9.1	< 1.5.122	2024-10-14
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.121 is vulnerable to Cross Site Scripting (XSS) CVE-2024-45454 · Source	High	7.1	< 1.5.122	2024-09-30

Fixed in version 1.5.113 (4)

Unlimited Elements for Elementor: Fixed in version 1.5.113
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection CVE-2024-6166 · Source	High	8.8	< 1.5.113	2024-07-08
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email' CVE-2024-6170 · Source	Medium	5.4	< 1.5.113	2024-07-08
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username' CVE-2024-6169 · Source	Medium	5.4	< 1.5.113	2024-07-08
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass CVE-2024-6171 · Source	Medium	5.3	< 1.5.113	2024-07-08

Fixed in version 1.5.110 (2)

Unlimited Elements for Elementor: Fixed in version 1.5.110
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data[addonID] Parameter CVE-2024-5329 · Source	High	8.8	< 1.5.110	2024-06-05
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.109 is vulnerable to Broken Access Control CVE-2024-35674 · Source	Medium	4.3	< 1.5.110	2024-06-05

Fixed in version 1.5.108 (2)

Unlimited Elements for Elementor: Fixed in version 1.5.108
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0] CVE-2024-4779 · Source	High	8.8	< 1.5.108	2024-05-22
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field CVE-2024-3190 · Source	Medium	4.6	< 1.5.108	2024-05-29

Fixed in version 1.5.105 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.105
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL Injection CVE-2024-3055 · Source	High	8.8	< 1.5.105	2024-05-10

Fixed in version 1.5.103 (2)

Unlimited Elements for Elementor: Fixed in version 1.5.103
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injection CVE-2024-2662 · Source	High	7.2	< 1.5.103	2024-05-09
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scripting CVE-2024-3547 · Source	Medium	6.1	< 1.5.103	2024-05-09

Fixed in version 1.5.97 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.97
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements For Elementor <= 1.5.96 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Link CVE-2024-0367 · Source	Medium	5.4	< 1.5.97	2024-03-29

Fixed in version 1.5.94 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.94
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.93 is vulnerable to Cross Site Scripting (XSS) CVE-2024-29792 · Source	High	7.1	< 1.5.94	2024-03-25

Fixed in version 1.5.91 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.91
Vulnerability	Severity	CVSS	Affected versions	Published
Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import CVE-2023-6743 · Source	High	8.8	< 1.5.91	2024-05-28

Fixed in version 1.5.75 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.75
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin < 1.5.75 is vulnerable to Cross Site Scripting (XSS) CVE-2023-33999 · Source	High	7.1	< 1.5.75	2023-07-18

Fixed in version 1.5.67 (2)

Unlimited Elements for Elementor: Fixed in version 1.5.67
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.66 is vulnerable to Bypass Vulnerability CVE-2023-33930 · Source	Critical	9.1	< 1.5.67	2023-05-22
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.66 - Authenticated (Contributor+) Arbitrary File Upload CVE-2023-3295 · Source	High	8.8	< 1.5.67	2023-06-16

Fixed in version 1.5.66 (2)

Unlimited Elements for Elementor: Fixed in version 1.5.66
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.65 is vulnerable to Arbitrary File Upload CVE-2023-31231 · Source	Critical	9.9	< 1.5.66	2023-06-20
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.65 is vulnerable to Broken Access Control CVE-2023-31080 · Source	High	8.3	< 1.5.66	2023-06-20

Fixed in version 1.5.61 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.61
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.60 is vulnerable to Other Vulnerability Type CVE-2023-31090 · Source	Critical	9.9	< 1.5.61	2023-05-22

Fixed in version 1.5.49 (1)

Unlimited Elements for Elementor: Fixed in version 1.5.49
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.48 is vulnerable to Cross Site Scripting (XSS) CVE-2022-47170 · Source	Medium	5.9	< 1.5.49	2023-01-27

Fixed in version 1.5.3 (4)

Unlimited Elements for Elementor: Fixed in version 1.5.3
Vulnerability	Severity	CVSS	Affected versions	Published
Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 · Source	Medium	6.3	< 1.5.3	2022-03-04
WordPress "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)" plugin < 1.5.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability No CVE assigned · Source	Not rated	-	< 1.5.3	2022-02-28
WordPress "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)" plugin < 1.5.3 - Sensitive Information Disclosure vulnerability No CVE assigned · Source	Not rated	-	< 1.5.3	2022-02-28
Unauthorised AJAX Calls via Freemius No CVE assigned · Source	Not rated	-	< 1.5.3	-

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.